Privacy Policy

Unless stated otherwise, BerthScanner is the data controller of the personal data you provide through the Service. You can contact us regarding any privacy matter at:

• Email: [email protected]
• Post: BerthScanner, Data Protection Officer, Athens, Greece
• Data Protection Officer: [email protected]

Where a marina you book with uses your personal data for its own purposes (for example, to fulfil your stay, manage access, or comply with port authority regulations), the marina acts as an independent controller for those purposes.

Information you provide to us

• Account details: full name, email address, password, optional phone number, profile photo, preferred language.
• Boat information: boat name, length, width, draft and any details needed to match you with a suitable berth.
• Booking details: dates of stay, number of guests, requested amenities, check-in / check-out times and special requests.
• Payment information: billing address and limited payment metadata. Card details are collected and processed directly by our payment service provider (Viva Wallet) – BerthScanner never stores your full card number or CVV.
• Identity verification: when required by a marina or by law (for example, port police filings in some EU countries), we may collect ID document references.
• Communications: messages you send through our support channels, feedback, reviews and responses to surveys.

Information collected automatically

• Device information: device type, browser type and version, operating system, unique device identifiers and crash reports.
• Usage information: pages viewed, features used, search queries, map interactions, clicks and referrer URLs.
• Location information: approximate location from your IP address and, with your consent, precise location used to show nearby marinas on the map.
• Log data: IP address, timestamps, accessed URLs and response codes, used for security monitoring and debugging.
• Cookies and similar technologies: see our Cookies Policy for details.

Information from third parties

• Social and single sign-on providers (for example, Google) when you choose to sign in using them, limited to the scopes you approve.
• Marinas you book with, who may share information related to your stay, incidents, damages, or outstanding balances.
• Payment providers, who share transaction status, fraud indicators and dispute information.
• Publicly available sources and fraud prevention partners, strictly for security and compliance purposes.

We process your personal data for the following purposes and based on the following legal bases under Article 6 GDPR:

To provide the Service (Art. 6(1)(b) – contract)

• Creating and maintaining your account.
• Matching your boat with suitable berths and availability.
• Processing bookings, payments, invoices and refunds.
• Facilitating communication between you and the marina.
• Sending transactional messages such as booking confirmations, reminders and receipts.

To comply with legal obligations (Art. 6(1)(c) – legal obligation)

• Tax, accounting and financial record-keeping.
• Anti-money laundering (AML) and fraud prevention.
• Responding to lawful requests from courts, regulators or law enforcement.
• Port police and customs filings when required by local law.

For our legitimate interests (Art. 6(1)(f) – legitimate interests)

• Protecting accounts and the Service against fraud, abuse and security incidents.
• Improving our product, performance and customer experience via aggregated analytics.
• Sending service updates, product announcements and non-marketing communications.
• Enforcing our Terms & Conditions and resolving disputes.

Based on your consent (Art. 6(1)(a) – consent)

• Non-essential cookies and similar technologies, as managed through our cookie banner.
• Marketing emails and personalised offers.
• Use of precise geolocation to show marinas near you.
• Any other processing where applicable law requires consent.

You may withdraw consent at any time without affecting the lawfulness of processing that took place before the withdrawal.

We share personal data only where necessary and with suitable safeguards. The main categories of recipients are:

• Marinas and their staff for bookings you make with them, to plan arrivals and fulfil your stay.
• Payment service providers (Viva Wallet) and banking partners to process transactions, prevent fraud and issue refunds.
• Cloud hosting, storage and email providers that operate the infrastructure behind the Service.
• Customer support and analytics providers acting under our instructions as processors.
• Professional advisers (lawyers, auditors, accountants) when strictly necessary.
• Public authorities, courts, regulators and law enforcement where required by law or to defend our legal rights.
• Potential or actual buyers in connection with a merger, acquisition, re-organisation or sale of assets, subject to appropriate confidentiality protections.

BerthScanner primarily hosts personal data within the European Economic Area (“EEA”). Where we or our service providers transfer personal data outside the EEA, UK or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards, including:

• Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum, where applicable).
• Supplementary technical measures such as encryption in transit and at rest.
• Where relevant, additional organisational measures and transfer impact assessments.

You can request a copy of the relevant safeguards by contacting us at [email protected].

We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements. Typical retention periods include:

• Active account data: for as long as your account is active, plus up to 24 months after deletion to handle disputes and enforce our Terms.
• Booking and financial records: up to 10 years after the relevant transaction, to meet tax, accounting and audit obligations.
• Customer support communications: up to 3 years from the last interaction.
• Security logs: generally up to 12 months.
• Marketing preferences: until you opt out, or 24 months of inactivity.

When retention is no longer justified, we either delete personal data or anonymise it so that it can no longer be linked to you.

We implement technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure or destruction, including:

• Encryption in transit (HTTPS/TLS) across the public web and in our APIs.
• Encryption at rest for databases and backups.
• Strict access controls, least-privilege permissions and multi-factor authentication for staff.
• Continuous monitoring, vulnerability scanning and regular security reviews.
• Secure software development practices and dependency management.
• Vendor due diligence and contractual data protection commitments from processors.

No system is ever 100% secure. If you believe your account has been compromised, please contact us immediately at [email protected].

Subject to applicable law, you have the following rights in relation to your personal data:

• Right of access – request a copy of the personal data we hold about you.
• Right to rectification – ask us to correct inaccurate or incomplete information.
• Right to erasure ("right to be forgotten") – request deletion of personal data we no longer need.
• Right to restriction – ask us to limit how we process your data in certain circumstances.
• Right to portability – receive your data in a structured, machine-readable format and have it transmitted to another controller where technically feasible.
• Right to object – object to processing based on legitimate interests, including profiling, and to direct marketing.
• Right to withdraw consent – at any time, where processing is based on your consent.
• Right to lodge a complaint – with your local supervisory authority, for example the Hellenic Data Protection Authority or the Irish Data Protection Commission.

You can exercise most of these rights directly from your account settings. For everything else, email [email protected]. We will respond within one month, extendable by up to two further months for complex requests.

The Service is not directed at children under the age of 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us so that we can delete it promptly.

We do not use your personal data to make decisions that produce legal or similarly significant effects on you solely by automated means. Some processes (for example, risk scoring for payments) may use automated tools to assist human reviewers, but a human is always involved in final decisions that have a significant impact on you.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a prominent notice in the Service before the change becomes effective. The “Last updated” date at the top of this page always reflects the current version.

If you have any questions, concerns or complaints about this Privacy Policy or our data practices, please contact us at [email protected]. You can also read our Cookies Policy and Terms & Conditions for related information.